Skip to content
Hacker Posts

Ivanti Connect Secure chain reaches unauth root; CVEs in KEV

Volexity says actor UTA0576 chains CVE-2026-104935 with two newly KEV-listed Ivanti Connect Secure flaws for unauthenticated root. Patch the privesc/file-upload components in 25.1.1.3 or 22.8R2.6.

Published 3 min read
cveivantivpnadvisory

CISA added two more Ivanti Connect Secure flaws to its Known Exploited Vulnerabilities catalog on October 30, completing an exploit chain that reaches unauthenticated root on the appliance. The anchor bug, CVE-2026-104935, has been KEV-listed and actively exploited since October 13. If you run Connect Secure exposed to the internet, this is a patch-today situation.

The three CVEs

Volexity, which discovered and reported the activity, says a previously undocumented actor it tracks as UTA0576 combined an authentication bypass, remote code execution, and a privilege-escalation flaw:

  • CVE-2026-104935 — authentication bypass, CVSS 8.6. Added to KEV October 13.
  • CVE-2026-111357 — missing authentication for a critical function, CVSS 8.8; lets a local authenticated attacker escalate privileges. Added to KEV October 30.
  • CVE-2026-118527 — predictable identifiers, CVSS 4.3; lets a remote authenticated attacker upload files to a known disk location. Added to KEV October 30.

As The Hacker News and BleepingComputer report, the auth-bypass alone is the October 13 zero-day; the October 30 KEV additions are the escalation and file-upload links that close the loop to root. Volexity observed exploitation against a fully patched 22.8R2.4 appliance, which is why a system that looks current may not be.

Affected and fixed versions

Ivanti lists CVE-2026-111357 and CVE-2026-118527 as fixed in 25.1.1.3 (for the 25.1.1.x branch) and 22.8R2.6 (for the 22.8 branch). CVE-2026-104935 was patched on October 13; confirm your build against Ivanti's advisory rather than assuming a prior update covered all three.

Exploitation status

Confirmed in the wild. The source is CISA's KEV listings and Volexity's investigation, not a single-vendor assertion. Per the reporting of Volexity's findings, UTA0576 extracted credentials and limited Active Directory metadata, ran host reconnaissance, and searched for administrator passwords and BitLocker recovery keys — post-exploitation behavior consistent with staging for deeper network access.

Action checklist

  1. Apply 25.1.1.3 or 22.8R2.6 for your branch now; a "patched" 22.8R2.4 box is still exploitable.
  2. Meet the federal deadlines as a floor, not a target. CISA requires FCEB agencies to remediate CVE-2026-111357 by November 2 and CVE-2026-118527 by November 13.
  3. Assume compromise if the appliance was internet-facing and unpatched. Rotate credentials that touched it, and pull AD service-account and admin-password access, plus BitLocker recovery-key reads, for review.
  4. Restrict management exposure and review Connect Secure logs for the exploitation window.

Context

This is the latest in a long run of Ivanti Connect Secure edge-device bugs reaching KEV, and it follows the familiar shape: a single zero-day disclosed, then quieter companion flaws that turn a serious bug into a full unauthenticated-root chain weeks later. The lesson for edge appliances holds — "fully patched" is a snapshot, and a gateway that terminates untrusted traffic earns continuous log review, not a set-and-forget patch cycle.

Related stories